Home

Awesome

Elastic for Red Teaming

Overview

Repository of resources for configuring a Red Team SIEM using Elastic

Note: This repository is a companion to a talk given at BSides Pittsburgh 2018.

Directory structure

.
├── ansible
│     └── Ansible playbooks for deploying an Elastic instance and configuring clients to forward the relevant logs 
├── elastalert
│     └── Elastalert example rules and configuration files
├── elastic
│     └── Example static configuration files
└── resources
      └── Resources for related services/technology such as Cobalt Strike

Roadmap